Question

We have created a database driven website using PHP with set cookies and now need to prevent HTTP spoofing, any ideas on how to do this? we are beginners with this so any help would be greatful

Answer 1

You cannot “spoof” HTTP requests. You send a request to the server, and the server responds appropriately.

I think what you are trying to prevent is cookie spoofing. Considering that cookies are stored on the client-side, there is nothing you can do to prevent users from modifying theirs contents.

Do not store sensitive information in your cookies. They are not secure and easily read and modified by the client.

Use PHP sessions instead. The full explanation on how sessions work and how to keep them secure can be read in one of my previous answers.

Essentially, securing sessions is done on two fronts:

• Preventing session fixation
  Regenerate a new session_id every X number of requests in order to reduce the amount of time an attacker has to steal the id.

• Uniquely identify the client
  Use the IP and/or the User-Agent to uniquely identify the client and check that value on every page load against the ones stored in the session. This is really the only two choices you have to uniquely identify the client.

Even with that in place, no solution is fool-proof and once your session_id is compromised, you are pretty much done for.

Again, for an in-depth explanation, please see my previous answer.